I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication.
The other item that is significant is the access token.
My idea was to send the id token to the client, and keep access token only on the server, so that when a user comes next time to the website they can "present" their "id token" and be considered as logged in.
I was wondering if it is a bad idea to send id token over the wire and cache it, or is it acceptable to do that?